Cyber and supply chain top concerns for Swedes – Sweden

Although they note improvements have been made to cyber cover, Sweden’s risk managers remain unconvinced by the solutions on offer and the risk industry’s ability to fully grasp this growing threat. On supply chain and nat cat risk, particularly in terms of contingent business interruption exposures and cover, the risk managers partly understand demands from insurers for improved data from corporates to continue the supply of risk transfer options.hideBut they appear somewhat frustrated by the level of demand placed upon them and some suggested a different approach to try and solve this global conundrum. “Cyber risk is something that needs to be looked at. Cyber risk means different things for different companies. Five years ago for us most of our key risks were mechanical but now we sell more and more electronic and mobile solutions. So how to assess those types of exposures and how to manage those and what type of insurance capacity is out there for those risks nobody really comprehends,” said Fredrik Finnman, Swerma’s President and Group Risk and Insurance Manager at ASSA ABLOY, who rates cyber risk as one of the scariest emerging risks yet to be fully indentified, measured, managed and transferred. Gaps in coverage for cyber risk, and some other insurance lines, exist because insurers tend to sell ‘off the shelf’ solutions rather than analysing insureds’ individual needs and situations, added the risk manager. “They don’t tend to map the risk and then come up with a solution. I think a lot of the products are more off the shelf, certainly in terms of cyber. More discussion is needed in order to get a product that works in real life,” he said. Lennart Edström, Vice President of Group Risk Management at Electrolux, the multinational household and professional appliances manufacturer, agreed that cyber risk remains one of the major risks that organisations face today and can cause confusion. He conceded that it is ‘very hard to fully understand our company’s risks within the cyber area’. “If I cannot come up with a clear and specific description of what I am talking about on cyber I have a hard sell internally. So it is a concern that grows more and more but it is still hard to grasp. If you ask 10 people what cyber risk is my guess is you will get 10 different answers. For example, if you ask someone from IT as opposed to the operations side you will get different responses—so it is difficult,” he explained. But this confusion is not helped by the fact that risk transfer partners appear equally stumped over cyber risk and are falling short in this critical area. There are a lot of suppliers and consultants who talk about cyber risk but it is very hard to understand exactly what they are selling, said Mr Edström. Although he believes the market is making progress. “I am gradually getting slightly more interested in the products. A year, or two years ago, I was not even interested because sellers were not able to communicate their products—where were the triggers, how was the cover designed. If you buy that cover and you communicate that internally people think we have cover and never see the exclusions. But if the insurer doesn’t fully understand how it should be handled in a claims situation how can I have the confidence to buy? I think the market needs to mature a little more before we go in. So if the board asks me are we covered for cyber risk I would say not—we have to manage the risk ourselves,” said Mr Edström. “I have my ear to the ground on cyber cover and there are positive developments but it is taking time. I also think you need a few claims as well to really develop the market—so people actually see there are payouts.” For her part, Charlotte Barnekow, Head of Insurance and Risk Management at Ericsson, the provider of telecommunications equipment, data communication, television and video systems, argued that cyber risks are difficult to pin down. “You have to pin the risks down in order to deal with them correctly. I think sometimes with a focus on enterprise risk management you lose the details and the devil is in the details when you deal with risk management,” she said. “We are now a society that deals in IT and I would say we are still immature in understanding how to deal with that. With this overflow of information, people struggle to find their way through and can’t see the wood for the trees,” added Ms Barnekow. Whilst new specific cyber transfer products are emerging, Ms Barnekow said she prefers opting to look at existing coverages and tailor those to her company’s cyber transfer needs. “I think, as we always have done, we need to continue working with existing coverages to mirror the new risks that we have—including cyber,” she argued. Ms Barnekow also noted that forthcoming changes to EU data protection rules that aim to better protect consumers will put a lot more pressure on companies to communicate, inform and notify in cases of a data privacy breach. This will be ‘very costly’ and add to the cyber threat, she said. On developments in coverage for key areas such as cyber, Anders Esbjörnsson, Group Risk Manager at construction firm NCC Försäkring AB, is ‘fairly’ content. Insurers, and perhaps more crucially brokers and consultants, are driving market changes more rapidly than used to be the case, he argued. “When I started at this company 10 years ago it was more the case that the insurers had a package that you could buy. Now risk transfer partners look into companies, assess our needs and you work with a broker to package your company’s risk and get quotes from insurers with solutions that fit your purpose, rather than us buying what insurers have in stock,” he said. The other big risk currently, according to the Swedish risk managers, relates to the supply chain and contingent business interruption in particular. There is increased demand for risk managers to supply more detailed information to insurers in order to obtain full cover for these exposures. Swedish risk managers understand this development but there are concerns over the level of detail required. “I fully understand why insurance companies are asking all of these questions. I think they are doing the right thing as it forces us to dig deep within our own organisations,” said Mr Edström. “The question is how far down [the supply chain] can you go and how far down will the insurance company ask for information,” he said. Mr Edström added that requests for sensitive information must be dealt with accordingly by insurers. “On CBI some of the information required by the insurers will be business secrets. When handing over this type of information we must ensure we have the right non-disclosure agreements in place.” But Ms Barnekow was less understanding of insurers’ demands for information on supply chain risk and is concerned that sub limits are being enforced and already limiting cover. For larger corporations the provision of detailed information on suppliers is problematic because they constantly change as a result of efficiency drives, she said. Ms Barnekow argued for a different approach from insurers whereby they monitor risk mitigation systems and practices rather than demand the finest of details. “It is important that insurers understand the risk but not necessarily as a result of zip code level detail. The information and risk assessment could just as well be found in the processes an organistaion has in place to actually procure a service or component. Proving that as an insured you have a solid process, good crisis management systems and cultural mechanisms in order to act immediately in case of earthquake or flooding or a supply chain issue is what I am talking about. That is the information that insurers should look at. Some do this but not always. You rather hear this noise about detailed information and uncertainty driving prices,” she said. Mr Esbjörnsson of NCC also bemoaned the fact that insurers demand more and more detailed information. He did concede, however, that it does afford a better understanding of risk. “Since I joined my company all insurers and reinsurers, no matter what line we are operating in, want more and more information from us on a much more detailed level. This is even the case on risks that we directly insure in the captive—so even for reinsurance they ask for as detailed information as they would do for direct insurance,” he said. “Half of the extra work we are forced to do in terms of reporting is not always necessary and adds value to us. There is some wastage and some overkill for sure,” he added. But it gives us a better understanding of our own company, he continued, adding that the extra time and effort pays off in reduced premiums. “This carrot is necessary of course because those companies with a good loss ratio that shows it has control over its risks should, and does, get a benefit on the premium side,” he said. Mr Edström also believes the supply of information is a two-way street and insurers could do more to provide insureds with better risk information. “We are feeding the information to the insurers on our risks as much as we can but I would also like to have the information available from the other side… They have a lot of information that I would like to get my hands on, or have a partner at these insurance companies with whom I can discuss how they look upon nat cat risks of clients. I could then use that information internally,” he said. “If we are planning a factory somewhere I would be extremely happy to go to the insurer and say okay we have these four sites, what is your view on them from a nat cat point of view? They have this information but there is not a natural flow to us as buyers. I don’t think they are unwilling, it is just not part of their practice. That would be good cooperation,” he added.

Cyber and supply chain top concerns for Swedes – Sweden

Want to read this article?

Read Next

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Alternative solutions and specialty drive Scor’s Q1 growth

AXA XL names new client and distribution officer in APAC and Europe

Costs rapidly rising for employee health insurance in Portugal

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Alternative solutions and specialty drive Scor’s Q1 growth

AXA XL names new client and distribution officer in APAC and Europe

Costs rapidly rising for employee health insurance in Portugal

Want to read this article?

Read Next

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Alternative solutions and specialty drive Scor’s Q1 growth

AXA XL names new client and distribution officer in APAC and Europe

Costs rapidly rising for employee health insurance in Portugal

Related Articles